Onboard Users to Microsoft Fabric - ivinnyaraujo/dataengineer-datascience-python GitHub Wiki

This guide explains how to provide internal and external users with access to reports and applications in Microsoft Fabric.

Access should be managed through Microsoft Entra ID security groups wherever possible.

Important: The options available may vary depending on your organisation's security policies, tenant settings and administrator permissions.

Before You Begin

Confirm that:

  • You have permission to invite guest users or manage users in Microsoft Entra ID.
  • You can manage membership of the relevant security groups.
  • The appropriate Microsoft Fabric or Power BI tenant settings allow guest access.
  • You know which reports, applications or data the user requires.
  • Any required row-level security or application audience has been configured.

1. Add an Internal User

Internal users normally already have an account in the organisation's Microsoft Entra tenant.

  1. Open the security group management page used by your organisation.
  2. Find the security group associated with the required application, report or access level.
  3. Review the group description to confirm that it provides the correct access.
  4. Add the user to the security group.
  5. Save the membership change.
  6. Verify that any additional application audience or row-level security assignment has been completed.
  7. Ask the user to test their access.

2. Add an External User

External users should normally be onboarded as guest users in the organisation's Microsoft Entra tenant.

The external user can sign in using their existing identity. A guest user record is created in the host tenant and can then be added to security groups or assigned access to applications.

Step 1: Open Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin centre.
  2. Select Entra ID.
  3. Under Identity, select Users.
  4. Select All users.

Step 2: Check Whether the User Already Exists

  1. Search using the external user's full email address.
  2. Review the search results to avoid creating a duplicate guest account.
  3. If a matching user is found, check the User type and account status.

Follow the appropriate path:

  • User found: Continue to #step-4-assign-access.
  • User not found: Continue to #step-3-invite-the-external-user.

Step 3: Invite the External User

  1. On the All users page, select New user.
  2. Select Invite external user.
  3. Enter the user's email address.
  4. Enter the user's display name, if required.
  5. Add an invitation message if appropriate.
  6. Review the details.
  7. Select Invite.

The external user should receive an invitation and sign in using their existing identity. A separate internal organisation account is not normally required for a Microsoft Entra B2B guest user.

Step 4: Assign Access

After the guest account has been created or confirmed:

  1. Open the appropriate Microsoft Entra security group.
  2. Select Members.
  3. Select Add members.
  4. Search for the guest user.
  5. Select the user.
  6. Confirm the membership change.
  7. If required, add the group or user to the relevant:
    • Microsoft Fabric workspace
    • Power BI application audience
    • Report permissions
    • Semantic model permissions
    • Row-level security role

Step 5: Ask the User to Test Access

Provide the user with:

  • The application or report link
  • Basic sign-in instructions
  • Information about possible terms-of-use prompts
  • Information about possible multifactor authentication prompts
  • A support contact
  • A brief explanation of the access granted